CVE-2024-2756

Published: Apr 29, 2024Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@php.net (Secondary)

Description

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://www.openwall.com/lists/oss-security/2024/04/12/11

Source: security@php.net

https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4

Source: security@php.net

https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html

Source: security@php.net

https://security.netapp.com/advisory/ntap-20240510-0008/

Source: security@php.net

http://www.openwall.com/lists/oss-security/2024/04/12/11

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20240510-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.